Exam Objectives 4.9
Given a scenario, use data sources to support an investigation.
- Log data: Detailed records crucial for investigations:
- Firewall logs: Track network traffic and security breaches
- Application logs: Capture user interactions and errors
- Endpoint logs: Document user activities and security events
- OS-specific security logs: Record system-level security activities
- IPS/IDS logs: Identify network threats and patterns
- Network logs: Records data flow and network performance
- Metadata: Provides context to enhance investigations
- Data sources: Vital elements in cybersecurity investigations:
- Vulnerability scans: Identify and prioritize system weaknesses
- Automated reports: Offer real-time insights and efficiency
- Dashboards: Visualize critical data for real-time monitoring
- Packet captures: Support forensics and network analysis
